Debian: DSA-4968-1: haproxy security update

Advisories


- -------------------------------------------------------------------------
Debian Security Advisory DSA-4968-1                   [email protected]
https://www.debian.org/security/                     Salvatore Bonaccorso
September 07, 2021                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : haproxy
CVE ID         : CVE-2021-40346

Ori Hollander reported that missing header name length checks in the
htx_add_header() and htx_add_trailer() functions in HAProxy, a fast and
reliable load balancing reverse proxy, could result in request smuggling
attacks or response splitting attacks.

Additionally this update addresses #993303 introduced in DSA 4960-1
causing HAProxy to fail serving URLs with HTTP/2 containing '//'.

For the stable distribution (bullseye), this problem has been fixed in
version 2.2.9-2+deb11u2.

We recommend that you upgrade your haproxy packages.

For the detailed security status of haproxy please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/haproxy

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

Debian: DSA-4968-1: haproxy security update

September 7, 2021
Ori Hollander reported that missing header name length checks in the htx_add_header() and htx_add_trailer() functions in HAProxy, a fast and reliable load balancing reverse proxy, ...

Summary

Additionally this update addresses #993303 introduced in DSA 4960-1
causing HAProxy to fail serving URLs with HTTP/2 containing '//'.

For the stable distribution (bullseye), this problem has been fixed in
version 2.2.9-2+deb11u2.

We recommend that you upgrade your haproxy packages.

For the detailed security status of haproxy please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/haproxy

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

Severity
Ori Hollander reported that missing header name length checks in the
htx_add_header() and htx_add_trailer() functions in HAProxy, a fast and
reliable load balancing reverse proxy, could result in request smuggling
attacks or response splitting attacks.

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.